Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87348
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.179 as permitted sender)
User-Agent: K-9 Mail for Android
In-Reply-To: <CAEZfaM5t3MpVk=rz7JUPdao=qq96J3cowWQmKboqTgLOXLqaCA@mail.gmail.com>
References: <CAEZfaM5t3MpVk=rz7JUPdao=qq96J3cowWQmKboqTgLOXLqaCA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----37N6IKEA8SD35K966IXGVHPQH6JOI8"
Content-Transfer-Encoding: 8bit
Date: Tue, 28 Jul 2015 21:12:27 +0100
To: internals@lists.php.net
Message-ID: <041328F1-A94D-4B36-BF4F-ED1D9AEB98A9@gmail.com>
Subject: Re: [PHP-DEV] [RFC] Block requests to builtin SQL functions where PHP can prove the call is vulnerable to a potential SQL-injection attack
From: rowan.collins@gmail.com (Rowan Collins)

------37N6IKEA8SD35K966IXGVHPQH6JOI8
Content-Transfer-Encoding: 8bit
Content-Type: text/plain;
 charset=UTF-8

On 28 July 2015 18:33:31 BST, Matt Tait <matt.tait@gmail.com> wrote:
>Hi all,
>
>I've written an RFC (and PoC) about automatic detection and blocking of
>SQL
>injection vulnerabilities directly from inside PHP via automated taint
>analysis.
>
>https://wiki.php.net/rfc/sql_injection_protection
 
Have you searched the list archive and wiki for previous discussions and prototypes of variable tainting? The idea may well have some legs, but there might be some interesting points from previous discussions to note in your RFC.

Also, 7.0 is already in beta, so your RFC will need to target 7.1 at the earliest.

Regards,
-- 
Rowan Collins
[IMSoP]
------37N6IKEA8SD35K966IXGVHPQH6JOI8--